CVE-2026-113329 in Chrome
Summary
by MITRE • 10/21/2026
Out of bounds read in Installer in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified as an out-of-bounds read within the Google Chrome installer component on macOS represents a significant memory safety flaw that undermines the integrity of the browser's execution environment. This specific defect, classified under CWE-125 which denotes Out-of-Bounds Read, occurs when the application attempts to access memory locations beyond the intended buffer boundaries during installation or update processes. Although the vulnerability is located in the installer rather than the main rendering engine, its presence indicates a lapse in boundary checking mechanisms that are critical for preventing unauthorized data exposure. The severity of this issue is rated as medium by Chromium security standards, reflecting the potential for information disclosure without immediate code execution capabilities.
The operational impact of this flaw centers on the ability of an attacker to potentially read sensitive memory contents from inside the browser sandbox through a crafted HTML page. By leveraging social engineering or malicious web content that triggers the installer logic under specific conditions, an adversary could exploit the out-of-bounds access to leak data residing in adjacent memory regions. This type of attack aligns with ATT&CK technique T1005 which involves Data from Local System, as it facilitates the extraction of information such as credentials, session tokens, or other confidential user data stored within the browser's protected space. The sandbox environment is designed to isolate web content from system resources, but memory corruption vulnerabilities like this one can serve as a stepping stone for further exploitation if combined with additional primitives.
Mitigation strategies primarily involve updating Google Chrome to version 156.0.8078.47 or later on macOS systems where the vulnerability exists. Users should ensure that automatic updates are enabled to receive security patches promptly, thereby closing the window of opportunity for attackers exploiting this memory safety issue. Additionally, organizations deploying Chrome in enterprise environments should verify patch compliance across all endpoints and consider implementing application control policies to restrict unauthorized installer executions. Regular auditing of browser versions and adherence to vendor-recommended update schedules remain essential practices for maintaining a secure posture against such vulnerabilities that target core system components.